{"slug": "curlhub-now-speaks-mcp-correctly-quoted-curl-for-ai-agents", "title": "curlhub Now Speaks MCP: Correctly Quoted curl for AI Agents", "summary": "Curlhub.sh has launched a Model Context Protocol (MCP) server that lets AI assistants generate correctly quoted curl commands, addressing a common failure where language models produce commands with shell quoting errors. The service, accessible via a one-line config with no key or signup, offers a single tool that constructs commands by wrapping values in POSIX single quotes and escaping embedded quotes, while blocking dangerous schemes like file://. It also supports browser integration via the emerging document.modelContext API.", "body_md": "curlhub.sh is now a **Model Context Protocol** server. If you use Claude Desktop, Cursor, or anything else that speaks MCP, your assistant can call curlhub as a tool instead of guessing at syntax and handing you something that almost works.\n\nOne line of config. No key, no signup:\n\n```\n{ \"mcpServers\": { \"curlhub\": { \"url\": \"https://curlhub.sh/mcp\" } } }\n```\n\nThe endpoint is `https://curlhub.sh/mcp`\n\n— JSON-RPC 2.0 over HTTP POST, sharing the same keyless quota as the rest of the site: 60 requests a minute per IP.\n\nThere is one tool, `validate_and_format_curl(url, method?, headers?, data?)`\n\n, and it exists because of a specific, boring failure that costs people real time.\n\nLanguage models write curl commands constantly, and they get the quoting wrong. Not often — but when they do, it fails *silently*. Consider a header value containing an apostrophe:\n\n```\ncurl -H 'X-Note: it's fine' https://api.example.com\n```\n\nThat apostrophe closes the quoted string. The shell now sees `X-Note:`\n\n, `its`\n\n, and `fine`\n\nas three separate words, and the command either errors confusingly or — worse — runs and does something you did not ask for. Nothing about the text on your screen looks wrong.\n\ncurlhub builds the command by construction instead. Every interpolated value is wrapped in POSIX single quotes, with embedded single quotes rendered as `'\\''`\n\n— close the quoted run, emit an escaped literal quote, reopen. Inside single quotes the shell treats every other byte literally, so `$`\n\n, backticks, backslashes, semicolons, newlines and globs are all inert. There is exactly one metacharacter to handle, and it is handled. That is the whole trick, and it is why the result is correct rather than usually-correct.\n\nThe same request, formatted properly:\n\n```\ncurl -H 'X-Note: it'\\''s fine' 'https://api.example.com'\n```\n\nSome things should not be escaped into looking fine. These return a 400 with a reason instead of a command:\n\n`file://`\n\n, `gopher://`\n\nand `dict://`\n\n. A generated command reaching for a local file is a footgun, so we will not write one.A detail worth stating because it silently corrupts JSON: `-d`\n\nstrips newlines and carriage returns, and treats a leading `@`\n\nas a filename. Generated commands use `--data-binary`\n\n, so your body survives intact.\n\nThe same thing works over plain HTTP, and returns text to curl and JSON to an API client at the same URL:\n\n```\ncurl -s https://curlhub.sh/format-curl \\\n  -H 'Accept: application/json' \\\n  -d '{\"method\":\"POST\",\"url\":\"https://api.example.com\",\"data\":\"{}\"}'\n```\n\nNothing is fetched and nothing is stored — it is a pure transform, and no outbound connection is ever made. Because of that, private and link-local targets are allowed: building a command for `127.0.0.1`\n\nor `169.254.169.254`\n\nis a normal developer task, not a request we need to police.\n\nPages here also register the same tool through `document.modelContext`\n\n, the emerging W3C browser API — native in Edge 147, and in Chrome 149 behind its origin trial. That call is same-origin, so it uses your existing session and quota and no key ever enters the model's context.\n\nThe server advertises itself the standard ways: a `Link`\n\nheader with `rel=\"mcp\"`\n\non every response, and a server card at `/.well-known/mcp/server-card.json`\n\n. Machine-readable documentation for agents lives at [/llms.txt](https://curlhub.sh/llms.txt).", "url": "https://wpnews.pro/news/curlhub-now-speaks-mcp-correctly-quoted-curl-for-ai-agents", "canonical_source": "https://dev.to/tuxxin/curlhub-now-speaks-mcp-correctly-quoted-curl-for-ai-agents-9j0", "published_at": "2026-09-03 08:05:28+00:00", "updated_at": "2026-09-03 08:25:04.956277+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-agents"], "entities": ["Model Context Protocol", "Claude Desktop", "Cursor", "W3C", "Edge", "Chrome"], "alternates": {"html": "https://wpnews.pro/news/curlhub-now-speaks-mcp-correctly-quoted-curl-for-ai-agents", "markdown": "https://wpnews.pro/news/curlhub-now-speaks-mcp-correctly-quoted-curl-for-ai-agents.md", "text": "https://wpnews.pro/news/curlhub-now-speaks-mcp-correctly-quoted-curl-for-ai-agents.txt", "jsonld": "https://wpnews.pro/news/curlhub-now-speaks-mcp-correctly-quoted-curl-for-ai-agents.jsonld"}}